CVE-2023-24871 is a vulnerability in the Windows Bluetooth stack, and ynwarcs’ write-up shows it affects multiple modules like bthport.sys and Microsoft.Bluetooth.Service.dll.
The vulnerability is an integer overflow in the BthLeLib_ADValidateBasic function that can lead to out-of-bounds memory writes when parsing Bluetooth Low Energy (BLE) advertisement data with more than 255 sections.
This vulnerability potentially allows for both remote code execution (RCE) and local privilege escalation (LPE) by an attacker who can craft malicious Bluetooth advertisement packets.
The series overview notes that Microsoft patched it in March 2023 but its advisory only mentions RCE, while the author published a working LPE exploit.
The RCE follow-up is refreshingly honest: the PoC triggers the bug from Bluetooth range in four scenarios, two of them without user interaction, but the author did not manage to turn it into actual code execution.
